Environment Variables

Environment Variables

Owner: Engineering Last reviewed: 2026-Q2

This page catalogs environment variables used by the repo. Values belong in local .env files, Azure DevOps variable groups, or Key Vault. Do not commit real secrets.

Backend

VariableRequiredPurposeSecret
AZURE_OPENAI_ENDPOINTYes for chat featuresAzure OpenAI endpoint for chat/action-point generationNo
AZURE_OPENAI_API_KEYYes for chat featuresAzure OpenAI API keyYes
AZURE_OPENAI_API_VERSIONYes for chat featuresAzure OpenAI API versionNo
AZURE_OPENAI_DEPLOYMENTYes for chat featuresAzure OpenAI deployment nameNo
AZURE_OPENAI_MODELNAMEOptional/configModel name metadataNo
AZURE_OPENAI_EMBEDDINGS_ENDPOINTYes for embeddingsAzure OpenAI embeddings endpointNo
AZURE_OPENAI_EMBEDDINGS_MODELNAMEYes for embeddingsEmbeddings deployment/model nameNo
AZURE_COMPUTER_VISION_ENDPOINTYes for OCRAzure Computer Vision endpointNo
AZURE_COMPUTER_VISION_KEYYes for OCRAzure Computer Vision keyYes
AZURE_DOCUMENT_INTELLIGENCE_ENDPOINTYes for document analysisAzure Document Intelligence endpointNo
AZURE_DOCUMENT_INTELLIGENCE_KEYYes for document analysisAzure Document Intelligence keyYes
MICROSOFT_CLIENT_IDYes for Azure SP flowsAzure service principal client IDSensitive
MICROSOFT_TENANT_IDYes for Azure SP flowsAzure tenant IDSensitive
MICROSOFT_CLIENT_SECRETYes for Azure SP flowsAzure service principal secretYes
STORAGE_ACCOUNT_NAMEYes for storageAzure Storage account nameNo
STORAGE_CONTAINER_NAMEYes for storageAzure Storage container nameNo
DB_URLYesDatabase host/URLSensitive
DB_USERYesDatabase usernameSensitive
DB_PASSWORDYesDatabase passwordYes
DB_NAMEYesDatabase nameNo
API_ENDPOINTEnvironment-dependentPublic API endpoint metadataNo
CLERK_FRONTEND_APIYesClerk issuer/JWKS base URLNo
CLERK_SECRET_KEYYes for Clerk server callsClerk backend secretYes
CLERK_AUTHORIZED_PARTIESRecommendedComma-separated allowed azp valuesNo
ENVIRONMENTRecommendedControls CORS/security behavior: development, staging, productionNo

Frontend

VariableRequiredPurposeSecret
VITE_APP_API_URLYesBackend API base URLNo
VITE_CLERK_PUBLISHABLE_KEYYesClerk browser publishable keyNo
VITE_CLERK_BILLING_PLAN_IDIf billing UI enabledClerk plan IDNo
VITE_CLERK_BILLING_PLAN_PERIODIf billing UI enabledBilling period used by UINo

Vite exposes VITE_* variables to the browser. Never put secrets in frontend environment variables.

Environment Sources

  • Local backend: copy backend/py/env.example to the local .env used by backend/py/main.py.
  • Local frontend: copy frontend/env.example to frontend/.env.
  • Azure DevOps: variable groups are selected by branch: dev, showcase, prod.
  • Production-grade secrets should live in Key Vault or protected variable groups.

Change Process

  • Adding a required env var must update this page, the relevant env.example, pipeline variable group, and deployment notes.
  • Removing or renaming an env var requires a staged rollout when old containers may still read the previous name.
  • Treat provider keys and DB credentials as rotation-capable; document rotation steps if they differ by provider.
CI/CD RunbookDatabase Operations